# SBOM: the software bill of materials, explained simply

Source: https://libwatch.com/en/glossary/sbom

Glossary · SBOM

What an SBOM is, what it's for, and why the Cyber Resilience Act makes it unavoidable.

Updated October 22, 2026 · 3-minute read

In one sentence

An SBOM (Software Bill of Materials) is the machine-readable list of every component that goes into a piece of software, with their versions.

## What it's for

When a vulnerability is published, an SBOM tells you in seconds whether a product ships the affected component, without digging through the code.

## The formats

Two standards dominate: [CycloneDX](/en/glossary/cyclonedx) (OWASP), security-oriented, and [SPDX](/en/glossary/spdx) (Linux Foundation), license-oriented. Both exist in JSON.

## What the CRA says

The [Cyber Resilience Act](/en/features/cra-nis2-compliance) requires manufacturers to keep an SBOM in a commonly used, machine-readable format, covering at least the top-level dependencies.

## And LibWatch?

LibWatch [generates a CycloneDX 1.5 or SPDX 2.3 SBOM](/en/features/sbom-export) for each project, from its inventory, without adding anything to your CI.

## See also

- Glossary
### [CycloneDX](/en/glossary/cyclonedx)

OWASP's SBOM format.

- Glossary
### [SPDX](/en/glossary/spdx)

The Linux Foundation's SBOM format.

- Glossary
### [SCA](/en/glossary/sca)

Software composition analysis.

## Your first SBOM, in two clicks.

[Generate an SBOM](https://app.libwatch.com/users/sign_up?source=glossary_sbom)